Yeah, docs forthcoming for this stuff, but you need to specify a couple more things to make it work (since the global *nix defaults don't make sense under Windows):
First and foremost, you never actually said you want to "become", just "who" you want to become- you need to add "become: yes" (this is not Windows-specific). Then you need to tell us which become method to use (become_method: runas), as the default "sudo" isn't implemented on Windows. You can set these at either the play or task level, as necessary, but "become: yes" is the key to actually making a task run as someone else- the rest is just "how". See below for a sample. Also, there's a bug right now that's preventing become from working under NTLM and Kerberos auth (fails with "Access is denied"), so you can only use it with Basic, CredSSP, and Certificate auth (hoping to nail this one down in the next few days). Hope that helps... -Matt (ansible-dev) [mdavis@mdavis-t460p win2012r2-domain]$ cat become.yml - hosts: member1 gather_facts: no become_method: runas tasks: - name: as default user win_shell: whoami - name: as administrator become: yes become_user: administrator win_shell: whoami (ansible-dev) [mdavis@mdavis-t460p win2012r2-domain]$ ansible-playbook -i hosts become.yml -vv -K No config file found; using defaults SUDO password: PLAYBOOK: become.yml ******************************************************************************* 1 plays in become.yml PLAY [member1] ************************************************************************************* META: ran handlers TASK [as default user] ***************************************************************************** task path: /home/mdavis/vm/win2012r2-domain/become.yml:5 changed: [member1] => {"changed": true, "cmd": "whoami", "delta": "0:00:00.156427", "end": "2017-03-02 11:29:12.986398", "rc": 0, "start": "2017-03-02 11:29:12.829970", "stderr": "", "stderr_lines": [], "stdout": "ansible\\testguy\r\n", "stdout_lines": ["ansible\\testguy"]} TASK [as administrator] **************************************************************************** task path: /home/mdavis/vm/win2012r2-domain/become.yml:8 changed: [member1] => {"changed": true, "cmd": "whoami", "delta": "0:00:00.187422", "end": "2017-03-02 11:29:13.876657", "rc": 0, "start": "2017-03-02 11:29:13.689234", "stderr": "", "stderr_lines": [], "stdout": "ansible\\testguy\r\n", "stdout_lines": ["ansible\\testguy"]} META: ran handlers META: ran handlers PLAY RECAP ***************************************************************************************** member1 : ok=2 changed=2 unreachable=0 failed=0 On Wednesday, March 1, 2017 at 10:32:21 PM UTC-8, b...@tanners.org wrote: > > Is there a way to "become_user" per task on a Windows? > > - name: Install programs (win_shell) > win_shell: "{{ item.dest }}/{{ item.program }} {{ item.arguments }}" > register: cmd > when: > - window_packages is defined > with_items: > - "{{ window_packages }}" > become_user: bob > tags: win_workstation2 > > Running the command with -vvvv shows I'm still WINRM as the Administrator > > <PC130.corp.local> ESTABLISH WINRM CONNECTION FOR USER: > Administrator@CORP.LOCAL on PORT 5986 TO PC130.corp.local EXEC (via > pipeline wrapper) > > Not sure how to check what user the task is running as but I don't find > the stuff I'd expect in AppData\Local > > -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to ansible-project+unsubscr...@googlegroups.com. To post to this group, send email to ansible-project@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/bad6e83e-066c-42d2-98eb-f79457920d62%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.